About the app key value store

The app key value store (or KV store) provides a way to save and retrieve data within your Splunk apps, thereby letting you manage and maintain the state of the application.

Here are some ways that Splunk apps might use the KV Store:

Tracking workflow in an incident-review system that moves an issue from one user to another.

Keeping a list of environment assets provided by users.

Controlling a job queue.

Managing a UI session by storing the user or application state as the user interacts with the app.

Storing user metadata.

Caching results from search queries by Splunk or an external data store.

Storing checkpoint data for modular inputs.

For information on using the KV store, see app key value store documentation for Splunk app developers.

How KV store works with your deployment

The KV store stores your data as key-value pairs in collections. Here are the main concepts:

Collections are the containers for your data, similar to a database table. Collections exist within the context of a given app.

Records contain each entry of your data, similar to a row in a database table.

Fields correspond to key names, similar to the columns in a database table. Fields contain the values of your data as a JSON file. Although it is not required, you can enforce data types (number, boolean, time, and string) for field values.

_key is a reserved field that contains the unique ID for each record. If you don't explicitly specify the _key value, the app auto-generates one.

_user is a reserved field that contains the user ID for each record. This field cannot be overridden.

Accelerations improve search performance by making searches that contain accelerated fields return faster. Accelerations store a small portion of the collection's data set in an easy-to-traverse form.

The KV store files reside on search heads.

In a search head cluster, if any node receives a write, the KV store delegates the write to the KV store captain. The KV store keeps the reads local, however.

System requirements

KV store is available and supported on all Splunk Enterprise 64-bit builds. It is not available on 32-bit Splunk Enterprise builds. KV store is also not available on universal forwarders. See the Splunk Enterprise system requirements.

About Splunk FIPS

If you enable FIPS but do not provide the required settings (caCertFile, sslKeysPath, and sslKeysPassword), KV store does not run. Look for error messages in splunkd.log and on the console that executes splunk start.

Determine whether your apps use KV store

KV store is enabled by default on Splunk Enterprise 6.2+.

Apps that use the KV store typically have collections.conf defined in $SPLUNK_HOME/etc/apps/<app name>/default. In addition, transforms.conf will have references to the collections with external_type = kvstore

Monitor the KV store on your Splunk Enterprise deployment

You can monitor your KV store performance through two views in the monitoring console. One view provides insight across your entire deployment. The other provides detailed information about KV store operations on each search head. See KV store dashboards in Monitoring Splunk Enterprise.

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »